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U.S, Department of Justice 

United States Attorney 

_ Southern District of New York 

The Silvio J. Mollo Building 
One Saint Andrew’s Plaza 
New York, New York 10007 


April 29, 2019 


Delivered to Courthouse SCIF 


Sabrina P. Shroff, Esq. 

Federal Defenders of New York 

52 Duane Street 

New York, New York 10007 

Re: United States v. Joshua Adam Schulte 

S2 17 Cr. 548 (PAC) 


Dear Counsel: 

(U) We write in response to your request for a bill of particulars, dated March 29, 2019. 
Although we do not believe that the Government is obligated to provide a bill of particulars in this 
matter - particularly given the detailed complaint outlining the child pornography charges and the 
attorney proffer that we gave to some of the defense team regarding the balance of the charged 
conduct - we nevertheless are providing the following information in response to your requests to 
help facilitate your preparation of pre-trial motions and for trial. The Government reserves the 
right to supplement or modify this disclosure, and notes that this disclosure is not intended to be 
the Government’s notice under Section 10 of the Classified Information Procedures Act (“CIPA”) 
or to be a comprehensive identification of the Government’s trial exhibits. Furthermore, this letter 
does not purport to specify the form in which the Government will seek to introduce any of the 
classified information described herein, and the Government reserves its rights under Sections 4 
and 6 of CIPA to seek to delete, summarize, or substitute any part of the classified information 
described in this letter. This letter is being provided to you pursuant to the “Protective Order 
Pertaining to Classified Information,” which was entered by the Court on August 16, 2018. 

(U) Response to Requests 1 through 3 

(U) Request 1 : “With respect to Count One (Illegal Gathering of National Defense 
Information), please identify what Classified Information Mr. Schulte allegedly took and the 
specific time period during which he allegedly took it.” 

( S/NF ) Response to Request 1 : Count One charges the defendant with illegally gathering 
and transmitting classified information in violation of Title 18, United States Code, Section 793(b). 
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been produced to you in classified discovery, 

(U) Request 2 : “With respect to Count Two (Illegal Transmission of Lawfully Possessed 
National Defense Information) and Count Three (Illegal Transmission of Unlawfully Possessed 
National Defense Information), please identify what Classified Information Mr. Schulte allegedly 
possessed, how he possessed it, the specific time period of the alleged possession and transmission, 
and the specific mode of the alleged transmission.” 

(U) Response to Request 2 : Please refer to our response to Request 1. With respect to 
the timing and mode of transmission, the Go vernment expects that the evidence at trial will show 
that Schulte transferred the stolen classified information in late April or early May 2016 using a 
combination of TOR and Tails software from his home desktop. 

(U) Request 3 ; “With respect to Count Four (Illegal Transmission and Attempted 
Transmission of Unlawfully Possessed National Defense Information), please identify what 
Classified Information and other national defense information Mr. Schulte allegedly possessed, 
the person or persons to whom he transmitted or attempted to transmit the information, the specific 
time period of the alleged transmission and attempted transmission, and the specific mode of 
transmission.” 

(U) Response to Request 3 : The specific classified information for which the defendant 
is being prosecuted in Count Four includes the following: 

(S^^NF) Since being arrested in this case, Schulte has written a series of essays (which 



(U) The Classified Article was transmitted by Schulte to his cousin, Shane Presnail. 
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(TS^H/NF) While Schulte was incarcerated in the Metropolitan Correctional Center 
(“MCC”), he used at least one contraband cellphone and an encrypted messaging application to 
transmit and attempt to transmit classified information to third parties, In particular, in or about 
September 2018, Sc hulte used an encr ypted messaging application to send a document to a third 
iarty that contained I 



Specifically, Schulte stated: 



(FSt^|/NF) During a search of the MCC on or about October 3, 2018, law enforcement 
recovered notebooks belonging to Schulte. The notebooks contained, among other things, 
classified information that Schulte intended to disseminate to the public. For example, one of the 
notebooks contains a document titled “Malware of the Mind” that discusses aspects of Schulte’s 
work at the agency (the “Malware Disclosure”). In particular, on pagejj of the document, Schulte 
states: 


(FS^^NF) In another of Schulte’s prison notebooks, Schulte drafted an apparent tweet 
that includes classified information (the “Fake Authentication TweeCTIntheFa^^uthentication 
Tweet, Schulte disclosed classified information concerning the 
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(U) The Classified Article, the Network Structure Document, the Malware Disclosure, and 
the Fake Authentication Tweet have all been produced to you in classified discovery. 

(U) Request 4 : “With respect to Count Five (Unauthorized Access to a Computer to 
Obtain Classified Information), Count Six (Theft of Government Property) and Count Seven 
(Unauthorized Access of a Computer to Obtain Information from a Department or Agency of the 
United States), please identify the alleged unauthorized access and what Classified Information 
Mr. Schulte allegedly obtained.” 

(U) Response to Request 4 : With respect to Counts Five and Six, please refer to the 
response to Request 1 as to what classified information Schulte stole. The Government believes 
that the evidence at trial will show that Schulte’s unauthorized access to CIA computer systems 
includes the following: 

• (U) On or about April 14, 2016, Schulte was informed that he was no longer an 
administrator for the program OSB Libraries. After learning of this, Schulte 
illegally logged into the Stash Server as a server administrator and reinstated his 
administrator privileges to OSB Libraries. 

• (U) On or about April 18, 2016, Schulte illegally accessed the ESXi server as a 
server administrator and around this time used a program that allowed him to view 
and edit log files. Schulte’s actions had the effect of altering the log files. 

• (U) On or about April 20, 2016, Schulte again illegally accessed the ESXi server 
as a server administrator. Schulte then created a snapshot of Confluence, which he 
titled “bkup” (the “April 20 Snapshot”). Schulte then unlawfully reverted 
Confluence to a snapshot of Confluence created on April 16, 2016. Schulte later 
reverted Confluence back to the April 20 Snapshot. After doing so, Schulte deleted 
the April 20 Snapshot, and then Schulte deleted various logs of his activity over the 
prior hour. Schulte’s deletion of the log files caused the system to stop creating 
certain log files going forward. 

• (U) In or about May and June 2016, after a server administrator mistakenly gave 
Schulte full access to Brutal Kangaroo, Schulte used that newly obtained access to 
illegally revoke the administrative privileges of the sole administrator of Brutal 
Kangaroo. Later, Schulte revoked the write privileges for Brutal Kangaroo from 
all other EDG employees assigned to work on Brutal Kangaroo. As a result, the 
employees responsible for Brutal Kangaroo no longer could write new code for the 
project. 
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(U) Request 5 : “With respect to Count Nine (Making False Statements) and Count Ten 
(Obstruction of Justice), please identify the alleged false statements, the specific person or persons 
to whom they were made, and what about the statements is false.” 

(U) Response to Request 5 : Counts Nine and Ten are based on a serious of false 
statements and misrepresentations made to law enforcement agents and/or prosecutors at the U.S. 
Attorney’s Office, who are identified in the FBI 302s recounting the defendant’s interviews. See 
JAS_020891 - 020919. The false statements for which Schulte is being prosecuted include: 

• On or about March 15, 2017, Schulte (i) denied having any involvement in leaking 
the classified information referenced above in our response to Request 1; (ii) stated 
that he had not kept a copy of an email he sent to the Office of Inspector General 
that discussed purported security issues at the CIA; and (iii) denied having any 
classified materials in his apartment. 

• On or about March 20 and 21, 2017, Schulte (i) denied having any involvement in 
leaking the classified information referenced above in our response to Request 1; 
(ii) denied ever taking information from the CIA and transferring it to an 
unclassified network; (iii) denied ever making CIA systems vulnerable to the theft 
of data; and (iv) denied housing information from the CIA on his home computer. 

• On or about June 29, 2017, Schulte (i) stated that he had never worked on Brutal 
Kangaroo outside of the CIA; and (ii) stated that he had never removed any 
classified information from the CIA and took it home. 

• On or about November 16, 2017, Schulte falsely described his trip to a court 
appearance from the vicinity of Grand Central Terminal to the vicinity of the 
courthouse, and also falsely claimed to have been approached on the way to that 
court appearance by an unknown male who allegedly stated, in substance and in 
part, that he knew that Schulte had been betrayed and bankrupted by the U.S. 
Government. 

(U) Request 6 : “With respect to Count Eleven (Contempt of Court), please identify which 
documents and information were allegedly communicated, and to which persons, in violation of 
the order.” 

(U) Response to Request 6 : As you are aware, we have already provided you with detailed 
search warrant affidavits describing Schulte’s violation of the protective order. As a result, we 
object to your request for more particular information. Nevertheless, please refer to the 
Government’s application for a search warrant, dated October 26, 2018, see JAS_021345 - 
021389, which describes Schulte’s violation of the protective order. Please also refer to the returns 
from the Government’s search warrant, dated October 6,2018, see JASJ321203 - 021205, relating 
to encrypted messaging accounts. 
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(U) Request 7 : “With respect to Count Twelve (Receipt of Child Pornography), Count 
Thirteen (Possession of Child Pornography), and Count Fourteen (Transportation of Child 
Pornography), please identify which electronic files, images or videos form the basis of each 
charge, the device or devices involved for each charge, and, for Counts Twelve and Thirteen, the 
specific time period for the alleged downloads and possession.” 

(U) Response to Request 7 : As you are aware, we have provided you with the specific 
locations of child pornography on Schulte’s home desktop computer. We object to your request 
calling for the Government to identify all of the files, images, and videos that contain child 
pornography. See United States v. Nunez , 2001 U.S. Dist. LEXIS 883. At *15 (S.D.N.Y. Feb. 1, 
2001) (“[A] bill of particulars is not a general investigative tool, a discovery device, or a means to 
compel the government to disclose evidence or witnesses to be offered prior to trial.”). See also 
United States v. Robles, 2005 U.S. Dist. LEXIS 7168, at *2-3 (S.D.N.Y. Apr. 21, 2005) (bill of 
particulars not appropriate to acquire evidentiary detail). We note that some files containing child 
pornography are identified in the complaint, and we will identify all of our exhibits well in advance 
of trial, including all images of child pornography. 

(U) Please feel free to contact us with any questions you may have. 

Sincerely yours, 

GEOFFREY S. BERMAN 
United States Attorney 

By: _ k/ _ 

Matthew Laroche / Sidhardha Kamaraju 
Assistant United States Attorneys 
(212)637-2420/6523 
Scott McCulloch 

Trial Attorney, National Security Division 
(202) 233-0793 
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